Data Protection Policy

6.2                      Some of the rights only apply in certain circumstances. Further guidance is provided in Southway’s Privacy Notice which can be found here.

7. Privacy Information

7.1                      Southway will provide information about the following matters to data subjects:

a)       Identity and contact details of Southway’s Data Protection Officer;

b)       Processing undertaken, purpose and legal bases;

c)       Categories of personal data processed;

d)       Anyone that Southway will share the data with;

e)       Details of any transfer of data to third countries and safeguards to ensure it remains secure;

f)         Retention periods;

g)       The existence of data subjects’ rights;

h)       The right to withdraw consent for processing, where relevant;

i)          The right to complain and how to do so;

j)          The source of personal data (where it is not supplied by the data subject);

k)       Whether providing personal data is part of a contractual obligation and the consequences of not providing it; and

l)          The existence of any automated decision making or profiling.

7.2                      A generic privacy statement will be published on our websites and privacy notices will be provided whenever we collect personal data.

7.3                      A separate Privacy Statement will be maintained that relates solely to how employees data is used by Southway. This will be available on the Staff Intranet, or on request from the Data Protection Officer, or the Human Resources Team.

7.4                      The information we provide will be clear and concise, written in Plain English and easily accessible.

8. Security and Personal Data Breaches

8.1                      There is a separate Information Security Policy.

8.2                      Southway’s DPO will inform the ICO of any personal data breach within 72 hours of the breach becoming apparent. A procedure is in place to inform staff what to do in the event of a breach.

8.3                      Employees, Board/Committee Members and data processors (including consultants and contractors) must inform the Head of Corporate Services immediately of any personal data breach, including the loss or theft of any ICT hardware or paper documentation that may contain personal data.

9. Marketing and Electronic Communications

9.1                      Southway will ensure that it is compliant with PECR, which covers:

a)       Marketing by electronic means, including marketing calls, texts and emails.

b)       The use of cookies or similar technologies that track information about people accessing a website or other electronic service.

c)       Security of public electronic communications services.

d)       Privacy of customers using communications networks or services as regards traffic and location data, itemised billing, line identification services and directory listings.

10. Transparency and Freedom of Information

10.1                 Southway is not obliged to comply with the Freedom of Information Act 2000 and does not have to respond to any requests made under the Act. However, we will operate within the spirit of the Act and be as open and transparent as possible. We will make available any non-confidential documents to our customers or any third party with a legitimate interest, providing the request is not deemed excessive.

11. Use of Data Processors

11.1                 Wherever Southway uses a third party to process data we will have a contract in place and will provide clear written instructions regarding the processing of personal data, to ensure both parties understand their obligations, responsibilities and liabilities.

11.2                 We will undertake due diligence prior to awarding a contract, to ensure data processors can meet the requirements of the GDPR and will conduct audits and inspections during contracts as appropriate.

11.3                 Contracts must set out:

a)       The subject matter and duration of the processing;

b)       The nature and purpose of the processing;

c)       The type of personal data and categories of data subjects; and

d)       The obligations and rights of the controller.

11.4                 Contracts must include as a minimum the following terms, requiring the processor to:

a)       Only act on Southway’s written instructions;

b)       Ensure that people processing the data are subject to a duty of confidence;

c)       Take appropriate measures to ensure the security of processing;

d)       Only engage sub-processors with Southway’s prior consent and under a written contract;

e)       Assist Southway in providing subject access and allowing data subjects to exercise their rights under the GDPR;

f)         Assist Southway in meeting our GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;

g)       Delete or return all personal data to Southway as requested at the end of the contract; and

h)       Submit to audits and inspections, provide Southway with whatever information we need to ensure that we are both meeting our Article 28 obligations, and tell Southway immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or the UK.

11.5                 Southway has a set of standard contract templates and clauses, accompanied by guidance, to enable employees to ensure each contract is appropriate for the purpose.

12. Information Sharing

12.1                 There will be occasions where Southway shares data with third parties (other data controllers, rather than data processors acting on Southway’s behalf). This might be a routine arrangement (e.g. involvement in a safeguarding board) or a one-off arrangement (e.g. where information is requested from the Police as part of a criminal investigation).

12.2                 All instances of data sharing must be recorded, with detail of the purpose and legal basis for doing so.

12.3                 For routine, systematic data sharing, there must be a written data sharing agreement in place, which must document as a minimum:

a)       The purpose of the sharing;

b)       The potential recipients or types of recipient and the circumstances in which they will have access;

c)       The data to be shared;

d)       Data security requirements and arrangements;

e)       Data retention arrangements;

f)         Procedures for dealing with access requests and fulfilling data subjects’ rights;

g)       The process for review of the effectiveness / termination of the sharing agreement;

h)       Sanctions for failure to comply with the agreement or breaches by individual staff.

13. Use of e-mail

13.1           Southway will avoid the use of e-mail for sharing personal data or sensitive personal data. If personal data is shared via e-mail, other security measures must be considered (encryption, or password protection)

13.2             Emails may need to be considered when we handle information requests under the right of access. Emails should be drafted carefully (ie be brief, factual and polite) and time should be taken to review the content of an email before it is sent.

13.3                 All Southway Staff will receive periodic reminders about the potential for data breaches due to use of e-mail. Staff who wilfully or negligently caused data breaches due to improper use of e-mail can be subject to disciplinary action.

13.4                 All e-mails will be deleted permanently from Southway’s system five years after the date they are sent or received.

13.5                 Southway will also set retention periods for all other electronic communication methods it employs.

14. Data Protection Officer (DPO)

14.1                 Southway will have a Data Protection Officer. This is currently the Head of Corporate Services (HCS). The tasks and responsibilities of the DPO are replicated in the Job Description of the HCS.

14.2                 Southway will take account of the DPO’s advice and the information they provide on our data protection obligations. If a decision is taken not to follow advice given by the DPO, the reasons for this will be recorded.

Accessibility

14.3                 The DPO will be easily accessible to Southway’s Board, Executive, employees, customers, other data subjects, and the ICO.

14.4                 The DPO will ensure that there are effective arrangements in place should they be absent. The Governance Manager will act as deputy in most instances.

14.5                 The DPO’s contact details will be:

a)       Published on the Southway and Gecko websites;

b)       Included in all privacy notices;

c)       Provided to employees on The Hive and as part of data protection procedures;

d)       Provided to the ICO (including when consulting them about a DPIA); and

e)       Provided to the ICO and to the individuals affected in the case of a personal data breach.

15.2                 There is a Data Protection Training Plan, specifying the level of expertise and the training required by each team or role.

15.3                 The DPO, in partnership with the HR and ICT Teams, is responsible for ensuring that this Training Plan is delivered and there is regular awareness raising.